A financial services firm is implementing single sign-on (SSO) to a multi-account AWS environment under AWS Organizations. The firm integrates its external SAML 2.0 Identity Provider (IdP) directly with the member accounts. A security engineer creates an IAM SAML identity provider in each member account and maps it to the external IdP metadata. The engineer then configures an IAM role in each member account for federated users. However, when users attempt to federate, the identity provider returns a failure during the SAML assertion phase.
A review of the configuration shows that:
1. An SCP is attached to the Organizational Unit (OU) containing these member accounts with a statement that allows `sts:AssumeRoleWithSAML` for all resources.
2. The trust policy of the IAM role in the member account is configured as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/CorporateIdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}
Which action must the security engineer take to resolve the federation failure?
- AModify the SCP attached to the OU to explicitly grant `sts:AssumeRole` to the SAML provider ARN.
- BModify the Action in the IAM role trust policy to `sts:AssumeRoleWithWebIdentity` and update the audience condition.
- Change the Action in the IAM role trust policy in each member account to `sts:AssumeRoleWithSAML`.Answer
- DUpdate the Principal in the IAM role trust policy to reference the AWS Organizations management account root ARN.